123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609 |
- // Copyright 2021 Google LLC
- //
- // Licensed under the Apache License, Version 2.0 (the "License");
- // you may not use this file except in compliance with the License.
- // You may obtain a copy of the License at
- //
- // http://www.apache.org/licenses/LICENSE-2.0
- //
- // Unless required by applicable law or agreed to in writing, software
- // distributed under the License is distributed on an "AS IS" BASIS,
- // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- // See the License for the specific language governing permissions and
- // limitations under the License.
- syntax = "proto3";
- package google.cloud.kms.v1;
- import "google/api/field_behavior.proto";
- import "google/api/resource.proto";
- import "google/protobuf/duration.proto";
- import "google/protobuf/timestamp.proto";
- import "google/protobuf/wrappers.proto";
- import "google/api/annotations.proto";
- option cc_enable_arenas = true;
- option csharp_namespace = "Google.Cloud.Kms.V1";
- option go_package = "google.golang.org/genproto/googleapis/cloud/kms/v1;kms";
- option java_multiple_files = true;
- option java_outer_classname = "KmsResourcesProto";
- option java_package = "com.google.cloud.kms.v1";
- option php_namespace = "Google\\Cloud\\Kms\\V1";
- // A [KeyRing][google.cloud.kms.v1.KeyRing] is a toplevel logical grouping of [CryptoKeys][google.cloud.kms.v1.CryptoKey].
- message KeyRing {
- option (google.api.resource) = {
- type: "cloudkms.googleapis.com/KeyRing"
- pattern: "projects/{project}/locations/{location}/keyRings/{key_ring}"
- };
- // Output only. The resource name for the [KeyRing][google.cloud.kms.v1.KeyRing] in the format
- // `projects/*/locations/*/keyRings/*`.
- string name = 1 [(google.api.field_behavior) = OUTPUT_ONLY];
- // Output only. The time at which this [KeyRing][google.cloud.kms.v1.KeyRing] was created.
- google.protobuf.Timestamp create_time = 2 [(google.api.field_behavior) = OUTPUT_ONLY];
- }
- // A [CryptoKey][google.cloud.kms.v1.CryptoKey] represents a logical key that can be used for cryptographic
- // operations.
- //
- // A [CryptoKey][google.cloud.kms.v1.CryptoKey] is made up of zero or more [versions][google.cloud.kms.v1.CryptoKeyVersion],
- // which represent the actual key material used in cryptographic operations.
- message CryptoKey {
- option (google.api.resource) = {
- type: "cloudkms.googleapis.com/CryptoKey"
- pattern: "projects/{project}/locations/{location}/keyRings/{key_ring}/cryptoKeys/{crypto_key}"
- };
- // [CryptoKeyPurpose][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose] describes the cryptographic capabilities of a
- // [CryptoKey][google.cloud.kms.v1.CryptoKey]. A given key can only be used for the operations allowed by
- // its purpose. For more information, see
- // [Key purposes](https://cloud.google.com/kms/docs/algorithms#key_purposes).
- enum CryptoKeyPurpose {
- // Not specified.
- CRYPTO_KEY_PURPOSE_UNSPECIFIED = 0;
- // [CryptoKeys][google.cloud.kms.v1.CryptoKey] with this purpose may be used with
- // [Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt] and
- // [Decrypt][google.cloud.kms.v1.KeyManagementService.Decrypt].
- ENCRYPT_DECRYPT = 1;
- // [CryptoKeys][google.cloud.kms.v1.CryptoKey] with this purpose may be used with
- // [AsymmetricSign][google.cloud.kms.v1.KeyManagementService.AsymmetricSign] and
- // [GetPublicKey][google.cloud.kms.v1.KeyManagementService.GetPublicKey].
- ASYMMETRIC_SIGN = 5;
- // [CryptoKeys][google.cloud.kms.v1.CryptoKey] with this purpose may be used with
- // [AsymmetricDecrypt][google.cloud.kms.v1.KeyManagementService.AsymmetricDecrypt] and
- // [GetPublicKey][google.cloud.kms.v1.KeyManagementService.GetPublicKey].
- ASYMMETRIC_DECRYPT = 6;
- }
- // Output only. The resource name for this [CryptoKey][google.cloud.kms.v1.CryptoKey] in the format
- // `projects/*/locations/*/keyRings/*/cryptoKeys/*`.
- string name = 1 [(google.api.field_behavior) = OUTPUT_ONLY];
- // Output only. A copy of the "primary" [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] that will be used
- // by [Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt] when this [CryptoKey][google.cloud.kms.v1.CryptoKey] is given
- // in [EncryptRequest.name][google.cloud.kms.v1.EncryptRequest.name].
- //
- // The [CryptoKey][google.cloud.kms.v1.CryptoKey]'s primary version can be updated via
- // [UpdateCryptoKeyPrimaryVersion][google.cloud.kms.v1.KeyManagementService.UpdateCryptoKeyPrimaryVersion].
- //
- // Keys with [purpose][google.cloud.kms.v1.CryptoKey.purpose]
- // [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT] may have a
- // primary. For other keys, this field will be omitted.
- CryptoKeyVersion primary = 2 [(google.api.field_behavior) = OUTPUT_ONLY];
- // Immutable. The immutable purpose of this [CryptoKey][google.cloud.kms.v1.CryptoKey].
- CryptoKeyPurpose purpose = 3 [(google.api.field_behavior) = IMMUTABLE];
- // Output only. The time at which this [CryptoKey][google.cloud.kms.v1.CryptoKey] was created.
- google.protobuf.Timestamp create_time = 5 [(google.api.field_behavior) = OUTPUT_ONLY];
- // At [next_rotation_time][google.cloud.kms.v1.CryptoKey.next_rotation_time], the Key Management Service will automatically:
- //
- // 1. Create a new version of this [CryptoKey][google.cloud.kms.v1.CryptoKey].
- // 2. Mark the new version as primary.
- //
- // Key rotations performed manually via
- // [CreateCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.CreateCryptoKeyVersion] and
- // [UpdateCryptoKeyPrimaryVersion][google.cloud.kms.v1.KeyManagementService.UpdateCryptoKeyPrimaryVersion]
- // do not affect [next_rotation_time][google.cloud.kms.v1.CryptoKey.next_rotation_time].
- //
- // Keys with [purpose][google.cloud.kms.v1.CryptoKey.purpose]
- // [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT] support
- // automatic rotation. For other keys, this field must be omitted.
- google.protobuf.Timestamp next_rotation_time = 7;
- // Controls the rate of automatic rotation.
- oneof rotation_schedule {
- // [next_rotation_time][google.cloud.kms.v1.CryptoKey.next_rotation_time] will be advanced by this period when the service
- // automatically rotates a key. Must be at least 24 hours and at most
- // 876,000 hours.
- //
- // If [rotation_period][google.cloud.kms.v1.CryptoKey.rotation_period] is set, [next_rotation_time][google.cloud.kms.v1.CryptoKey.next_rotation_time] must also be set.
- //
- // Keys with [purpose][google.cloud.kms.v1.CryptoKey.purpose]
- // [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT] support
- // automatic rotation. For other keys, this field must be omitted.
- google.protobuf.Duration rotation_period = 8;
- }
- // A template describing settings for new [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] instances.
- // The properties of new [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] instances created by either
- // [CreateCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.CreateCryptoKeyVersion] or
- // auto-rotation are controlled by this template.
- CryptoKeyVersionTemplate version_template = 11;
- // Labels with user-defined metadata. For more information, see
- // [Labeling Keys](https://cloud.google.com/kms/docs/labeling-keys).
- map<string, string> labels = 10;
- }
- // A [CryptoKeyVersionTemplate][google.cloud.kms.v1.CryptoKeyVersionTemplate] specifies the properties to use when creating
- // a new [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion], either manually with
- // [CreateCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.CreateCryptoKeyVersion] or
- // automatically as a result of auto-rotation.
- message CryptoKeyVersionTemplate {
- // [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] to use when creating a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] based on
- // this template. Immutable. Defaults to [SOFTWARE][google.cloud.kms.v1.ProtectionLevel.SOFTWARE].
- ProtectionLevel protection_level = 1;
- // Required. [Algorithm][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionAlgorithm] to use
- // when creating a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] based on this template.
- //
- // For backwards compatibility, GOOGLE_SYMMETRIC_ENCRYPTION is implied if both
- // this field is omitted and [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] is
- // [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT].
- CryptoKeyVersion.CryptoKeyVersionAlgorithm algorithm = 3 [(google.api.field_behavior) = REQUIRED];
- }
- // Contains an HSM-generated attestation about a key operation. For more
- // information, see [Verifying attestations]
- // (https://cloud.google.com/kms/docs/attest-key).
- message KeyOperationAttestation {
- // Attestation formats provided by the HSM.
- enum AttestationFormat {
- // Not specified.
- ATTESTATION_FORMAT_UNSPECIFIED = 0;
- // Cavium HSM attestation compressed with gzip. Note that this format is
- // defined by Cavium and subject to change at any time.
- CAVIUM_V1_COMPRESSED = 3;
- // Cavium HSM attestation V2 compressed with gzip. This is a new format
- // introduced in Cavium's version 3.2-08.
- CAVIUM_V2_COMPRESSED = 4;
- }
- // Output only. The format of the attestation data.
- AttestationFormat format = 4 [(google.api.field_behavior) = OUTPUT_ONLY];
- // Output only. The attestation data provided by the HSM when the key
- // operation was performed.
- bytes content = 5 [(google.api.field_behavior) = OUTPUT_ONLY];
- }
- // A [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] represents an individual cryptographic key, and the
- // associated key material.
- //
- // An [ENABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.ENABLED] version can be
- // used for cryptographic operations.
- //
- // For security reasons, the raw cryptographic key material represented by a
- // [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] can never be viewed or exported. It can only be used to
- // encrypt, decrypt, or sign data when an authorized user or application invokes
- // Cloud KMS.
- message CryptoKeyVersion {
- option (google.api.resource) = {
- type: "cloudkms.googleapis.com/CryptoKeyVersion"
- pattern: "projects/{project}/locations/{location}/keyRings/{key_ring}/cryptoKeys/{crypto_key}/cryptoKeyVersions/{crypto_key_version}"
- };
- // The algorithm of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion], indicating what
- // parameters must be used for each cryptographic operation.
- //
- // The
- // [GOOGLE_SYMMETRIC_ENCRYPTION][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionAlgorithm.GOOGLE_SYMMETRIC_ENCRYPTION]
- // algorithm is usable with [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose]
- // [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT].
- //
- // Algorithms beginning with "RSA_SIGN_" are usable with [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose]
- // [ASYMMETRIC_SIGN][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ASYMMETRIC_SIGN].
- //
- // The fields in the name after "RSA_SIGN_" correspond to the following
- // parameters: padding algorithm, modulus bit length, and digest algorithm.
- //
- // For PSS, the salt length used is equal to the length of digest
- // algorithm. For example,
- // [RSA_SIGN_PSS_2048_SHA256][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionAlgorithm.RSA_SIGN_PSS_2048_SHA256]
- // will use PSS with a salt length of 256 bits or 32 bytes.
- //
- // Algorithms beginning with "RSA_DECRYPT_" are usable with
- // [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose]
- // [ASYMMETRIC_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ASYMMETRIC_DECRYPT].
- //
- // The fields in the name after "RSA_DECRYPT_" correspond to the following
- // parameters: padding algorithm, modulus bit length, and digest algorithm.
- //
- // Algorithms beginning with "EC_SIGN_" are usable with [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose]
- // [ASYMMETRIC_SIGN][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ASYMMETRIC_SIGN].
- //
- // The fields in the name after "EC_SIGN_" correspond to the following
- // parameters: elliptic curve, digest algorithm.
- //
- // For more information, see [Key purposes and algorithms]
- // (https://cloud.google.com/kms/docs/algorithms).
- enum CryptoKeyVersionAlgorithm {
- // Not specified.
- CRYPTO_KEY_VERSION_ALGORITHM_UNSPECIFIED = 0;
- // Creates symmetric encryption keys.
- GOOGLE_SYMMETRIC_ENCRYPTION = 1;
- // RSASSA-PSS 2048 bit key with a SHA256 digest.
- RSA_SIGN_PSS_2048_SHA256 = 2;
- // RSASSA-PSS 3072 bit key with a SHA256 digest.
- RSA_SIGN_PSS_3072_SHA256 = 3;
- // RSASSA-PSS 4096 bit key with a SHA256 digest.
- RSA_SIGN_PSS_4096_SHA256 = 4;
- // RSASSA-PSS 4096 bit key with a SHA512 digest.
- RSA_SIGN_PSS_4096_SHA512 = 15;
- // RSASSA-PKCS1-v1_5 with a 2048 bit key and a SHA256 digest.
- RSA_SIGN_PKCS1_2048_SHA256 = 5;
- // RSASSA-PKCS1-v1_5 with a 3072 bit key and a SHA256 digest.
- RSA_SIGN_PKCS1_3072_SHA256 = 6;
- // RSASSA-PKCS1-v1_5 with a 4096 bit key and a SHA256 digest.
- RSA_SIGN_PKCS1_4096_SHA256 = 7;
- // RSASSA-PKCS1-v1_5 with a 4096 bit key and a SHA512 digest.
- RSA_SIGN_PKCS1_4096_SHA512 = 16;
- // RSAES-OAEP 2048 bit key with a SHA256 digest.
- RSA_DECRYPT_OAEP_2048_SHA256 = 8;
- // RSAES-OAEP 3072 bit key with a SHA256 digest.
- RSA_DECRYPT_OAEP_3072_SHA256 = 9;
- // RSAES-OAEP 4096 bit key with a SHA256 digest.
- RSA_DECRYPT_OAEP_4096_SHA256 = 10;
- // RSAES-OAEP 4096 bit key with a SHA512 digest.
- RSA_DECRYPT_OAEP_4096_SHA512 = 17;
- // ECDSA on the NIST P-256 curve with a SHA256 digest.
- EC_SIGN_P256_SHA256 = 12;
- // ECDSA on the NIST P-384 curve with a SHA384 digest.
- EC_SIGN_P384_SHA384 = 13;
- // ECDSA on the non-NIST secp256k1 curve. This curve is only supported for
- // HSM protection level.
- EC_SIGN_SECP256K1_SHA256 = 31;
- // Algorithm representing symmetric encryption by an external key manager.
- EXTERNAL_SYMMETRIC_ENCRYPTION = 18;
- }
- // The state of a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion], indicating if it can be used.
- enum CryptoKeyVersionState {
- // Not specified.
- CRYPTO_KEY_VERSION_STATE_UNSPECIFIED = 0;
- // This version is still being generated. It may not be used, enabled,
- // disabled, or destroyed yet. Cloud KMS will automatically mark this
- // version [ENABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.ENABLED] as soon as the version is ready.
- PENDING_GENERATION = 5;
- // This version may be used for cryptographic operations.
- ENABLED = 1;
- // This version may not be used, but the key material is still available,
- // and the version can be placed back into the [ENABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.ENABLED] state.
- DISABLED = 2;
- // This version is destroyed, and the key material is no longer stored.
- // A version may not leave this state once entered.
- DESTROYED = 3;
- // This version is scheduled for destruction, and will be destroyed soon.
- // Call
- // [RestoreCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.RestoreCryptoKeyVersion]
- // to put it back into the [DISABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DISABLED] state.
- DESTROY_SCHEDULED = 4;
- // This version is still being imported. It may not be used, enabled,
- // disabled, or destroyed yet. Cloud KMS will automatically mark this
- // version [ENABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.ENABLED] as soon as the version is ready.
- PENDING_IMPORT = 6;
- // This version was not imported successfully. It may not be used, enabled,
- // disabled, or destroyed. The submitted key material has been discarded.
- // Additional details can be found in
- // [CryptoKeyVersion.import_failure_reason][google.cloud.kms.v1.CryptoKeyVersion.import_failure_reason].
- IMPORT_FAILED = 7;
- }
- // A view for [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]s. Controls the level of detail returned
- // for [CryptoKeyVersions][google.cloud.kms.v1.CryptoKeyVersion] in
- // [KeyManagementService.ListCryptoKeyVersions][google.cloud.kms.v1.KeyManagementService.ListCryptoKeyVersions] and
- // [KeyManagementService.ListCryptoKeys][google.cloud.kms.v1.KeyManagementService.ListCryptoKeys].
- enum CryptoKeyVersionView {
- // Default view for each [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]. Does not include
- // the [attestation][google.cloud.kms.v1.CryptoKeyVersion.attestation] field.
- CRYPTO_KEY_VERSION_VIEW_UNSPECIFIED = 0;
- // Provides all fields in each [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion], including the
- // [attestation][google.cloud.kms.v1.CryptoKeyVersion.attestation].
- FULL = 1;
- }
- // Output only. The resource name for this [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] in the format
- // `projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*`.
- string name = 1 [(google.api.field_behavior) = OUTPUT_ONLY];
- // The current state of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion].
- CryptoKeyVersionState state = 3;
- // Output only. The [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] describing how crypto operations are
- // performed with this [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion].
- ProtectionLevel protection_level = 7 [(google.api.field_behavior) = OUTPUT_ONLY];
- // Output only. The [CryptoKeyVersionAlgorithm][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionAlgorithm] that this
- // [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] supports.
- CryptoKeyVersionAlgorithm algorithm = 10 [(google.api.field_behavior) = OUTPUT_ONLY];
- // Output only. Statement that was generated and signed by the HSM at key
- // creation time. Use this statement to verify attributes of the key as stored
- // on the HSM, independently of Google. Only provided for key versions with
- // [protection_level][google.cloud.kms.v1.CryptoKeyVersion.protection_level] [HSM][google.cloud.kms.v1.ProtectionLevel.HSM].
- KeyOperationAttestation attestation = 8 [(google.api.field_behavior) = OUTPUT_ONLY];
- // Output only. The time at which this [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] was created.
- google.protobuf.Timestamp create_time = 4 [(google.api.field_behavior) = OUTPUT_ONLY];
- // Output only. The time this [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]'s key material was
- // generated.
- google.protobuf.Timestamp generate_time = 11 [(google.api.field_behavior) = OUTPUT_ONLY];
- // Output only. The time this [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]'s key material is scheduled
- // for destruction. Only present if [state][google.cloud.kms.v1.CryptoKeyVersion.state] is
- // [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED].
- google.protobuf.Timestamp destroy_time = 5 [(google.api.field_behavior) = OUTPUT_ONLY];
- // Output only. The time this CryptoKeyVersion's key material was
- // destroyed. Only present if [state][google.cloud.kms.v1.CryptoKeyVersion.state] is
- // [DESTROYED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROYED].
- google.protobuf.Timestamp destroy_event_time = 6 [(google.api.field_behavior) = OUTPUT_ONLY];
- // Output only. The name of the [ImportJob][google.cloud.kms.v1.ImportJob] used to import this
- // [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]. Only present if the underlying key material was
- // imported.
- string import_job = 14 [(google.api.field_behavior) = OUTPUT_ONLY];
- // Output only. The time at which this [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]'s key material
- // was imported.
- google.protobuf.Timestamp import_time = 15 [(google.api.field_behavior) = OUTPUT_ONLY];
- // Output only. The root cause of an import failure. Only present if
- // [state][google.cloud.kms.v1.CryptoKeyVersion.state] is
- // [IMPORT_FAILED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.IMPORT_FAILED].
- string import_failure_reason = 16 [(google.api.field_behavior) = OUTPUT_ONLY];
- // ExternalProtectionLevelOptions stores a group of additional fields for
- // configuring a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] that are specific to the
- // [EXTERNAL][google.cloud.kms.v1.ProtectionLevel.EXTERNAL] protection level.
- ExternalProtectionLevelOptions external_protection_level_options = 17;
- }
- // The public key for a given [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]. Obtained via
- // [GetPublicKey][google.cloud.kms.v1.KeyManagementService.GetPublicKey].
- message PublicKey {
- option (google.api.resource) = {
- type: "cloudkms.googleapis.com/PublicKey"
- pattern: "projects/{project}/locations/{location}/keyRings/{key_ring}/cryptoKeys/{crypto_key}/cryptoKeyVersions/{crypto_key_version}/publicKey"
- };
- // The public key, encoded in PEM format. For more information, see the
- // [RFC 7468](https://tools.ietf.org/html/rfc7468) sections for
- // [General Considerations](https://tools.ietf.org/html/rfc7468#section-2) and
- // [Textual Encoding of Subject Public Key Info]
- // (https://tools.ietf.org/html/rfc7468#section-13).
- string pem = 1;
- // The [Algorithm][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionAlgorithm] associated
- // with this key.
- CryptoKeyVersion.CryptoKeyVersionAlgorithm algorithm = 2;
- // Integrity verification field. A CRC32C checksum of the returned
- // [PublicKey.pem][google.cloud.kms.v1.PublicKey.pem]. An integrity check of [PublicKey.pem][google.cloud.kms.v1.PublicKey.pem] can be performed
- // by computing the CRC32C checksum of [PublicKey.pem][google.cloud.kms.v1.PublicKey.pem] and
- // comparing your results to this field. Discard the response in case of
- // non-matching checksum values, and perform a limited number of retries. A
- // persistent mismatch may indicate an issue in your computation of the CRC32C
- // checksum.
- // Note: This field is defined as int64 for reasons of compatibility across
- // different languages. However, it is a non-negative integer, which will
- // never exceed 2^32-1, and can be safely downconverted to uint32 in languages
- // that support this type.
- //
- // NOTE: This field is in Beta.
- google.protobuf.Int64Value pem_crc32c = 3;
- // The [name][google.cloud.kms.v1.CryptoKeyVersion.name] of the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] public key.
- // Provided here for verification.
- //
- // NOTE: This field is in Beta.
- string name = 4;
- }
- // An [ImportJob][google.cloud.kms.v1.ImportJob] can be used to create [CryptoKeys][google.cloud.kms.v1.CryptoKey] and
- // [CryptoKeyVersions][google.cloud.kms.v1.CryptoKeyVersion] using pre-existing key material,
- // generated outside of Cloud KMS.
- //
- // When an [ImportJob][google.cloud.kms.v1.ImportJob] is created, Cloud KMS will generate a "wrapping key",
- // which is a public/private key pair. You use the wrapping key to encrypt (also
- // known as wrap) the pre-existing key material to protect it during the import
- // process. The nature of the wrapping key depends on the choice of
- // [import_method][google.cloud.kms.v1.ImportJob.import_method]. When the wrapping key generation
- // is complete, the [state][google.cloud.kms.v1.ImportJob.state] will be set to
- // [ACTIVE][google.cloud.kms.v1.ImportJob.ImportJobState.ACTIVE] and the [public_key][google.cloud.kms.v1.ImportJob.public_key]
- // can be fetched. The fetched public key can then be used to wrap your
- // pre-existing key material.
- //
- // Once the key material is wrapped, it can be imported into a new
- // [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] in an existing [CryptoKey][google.cloud.kms.v1.CryptoKey] by calling
- // [ImportCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.ImportCryptoKeyVersion].
- // Multiple [CryptoKeyVersions][google.cloud.kms.v1.CryptoKeyVersion] can be imported with a single
- // [ImportJob][google.cloud.kms.v1.ImportJob]. Cloud KMS uses the private key portion of the wrapping key to
- // unwrap the key material. Only Cloud KMS has access to the private key.
- //
- // An [ImportJob][google.cloud.kms.v1.ImportJob] expires 3 days after it is created. Once expired, Cloud KMS
- // will no longer be able to import or unwrap any key material that was wrapped
- // with the [ImportJob][google.cloud.kms.v1.ImportJob]'s public key.
- //
- // For more information, see
- // [Importing a key](https://cloud.google.com/kms/docs/importing-a-key).
- message ImportJob {
- option (google.api.resource) = {
- type: "cloudkms.googleapis.com/ImportJob"
- pattern: "projects/{project}/locations/{location}/keyRings/{key_ring}/importJobs/{import_job}"
- };
- // The public key component of the wrapping key. For details of the type of
- // key this public key corresponds to, see the [ImportMethod][google.cloud.kms.v1.ImportJob.ImportMethod].
- message WrappingPublicKey {
- // The public key, encoded in PEM format. For more information, see the [RFC
- // 7468](https://tools.ietf.org/html/rfc7468) sections for [General
- // Considerations](https://tools.ietf.org/html/rfc7468#section-2) and
- // [Textual Encoding of Subject Public Key Info]
- // (https://tools.ietf.org/html/rfc7468#section-13).
- string pem = 1;
- }
- // [ImportMethod][google.cloud.kms.v1.ImportJob.ImportMethod] describes the key wrapping method chosen for this
- // [ImportJob][google.cloud.kms.v1.ImportJob].
- enum ImportMethod {
- // Not specified.
- IMPORT_METHOD_UNSPECIFIED = 0;
- // This ImportMethod represents the CKM_RSA_AES_KEY_WRAP key wrapping
- // scheme defined in the PKCS #11 standard. In summary, this involves
- // wrapping the raw key with an ephemeral AES key, and wrapping the
- // ephemeral AES key with a 3072 bit RSA key. For more details, see
- // [RSA AES key wrap
- // mechanism](http://docs.oasis-open.org/pkcs11/pkcs11-curr/v2.40/cos01/pkcs11-curr-v2.40-cos01.html#_Toc408226908).
- RSA_OAEP_3072_SHA1_AES_256 = 1;
- // This ImportMethod represents the CKM_RSA_AES_KEY_WRAP key wrapping
- // scheme defined in the PKCS #11 standard. In summary, this involves
- // wrapping the raw key with an ephemeral AES key, and wrapping the
- // ephemeral AES key with a 4096 bit RSA key. For more details, see
- // [RSA AES key wrap
- // mechanism](http://docs.oasis-open.org/pkcs11/pkcs11-curr/v2.40/cos01/pkcs11-curr-v2.40-cos01.html#_Toc408226908).
- RSA_OAEP_4096_SHA1_AES_256 = 2;
- }
- // The state of the [ImportJob][google.cloud.kms.v1.ImportJob], indicating if it can be used.
- enum ImportJobState {
- // Not specified.
- IMPORT_JOB_STATE_UNSPECIFIED = 0;
- // The wrapping key for this job is still being generated. It may not be
- // used. Cloud KMS will automatically mark this job as
- // [ACTIVE][google.cloud.kms.v1.ImportJob.ImportJobState.ACTIVE] as soon as the wrapping key is generated.
- PENDING_GENERATION = 1;
- // This job may be used in
- // [CreateCryptoKey][google.cloud.kms.v1.KeyManagementService.CreateCryptoKey] and
- // [CreateCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.CreateCryptoKeyVersion]
- // requests.
- ACTIVE = 2;
- // This job can no longer be used and may not leave this state once entered.
- EXPIRED = 3;
- }
- // Output only. The resource name for this [ImportJob][google.cloud.kms.v1.ImportJob] in the format
- // `projects/*/locations/*/keyRings/*/importJobs/*`.
- string name = 1 [(google.api.field_behavior) = OUTPUT_ONLY];
- // Required. Immutable. The wrapping method to be used for incoming key material.
- ImportMethod import_method = 2 [
- (google.api.field_behavior) = REQUIRED,
- (google.api.field_behavior) = IMMUTABLE
- ];
- // Required. Immutable. The protection level of the [ImportJob][google.cloud.kms.v1.ImportJob]. This must match the
- // [protection_level][google.cloud.kms.v1.CryptoKeyVersionTemplate.protection_level] of the
- // [version_template][google.cloud.kms.v1.CryptoKey.version_template] on the [CryptoKey][google.cloud.kms.v1.CryptoKey] you
- // attempt to import into.
- ProtectionLevel protection_level = 9 [
- (google.api.field_behavior) = REQUIRED,
- (google.api.field_behavior) = IMMUTABLE
- ];
- // Output only. The time at which this [ImportJob][google.cloud.kms.v1.ImportJob] was created.
- google.protobuf.Timestamp create_time = 3 [(google.api.field_behavior) = OUTPUT_ONLY];
- // Output only. The time this [ImportJob][google.cloud.kms.v1.ImportJob]'s key material was generated.
- google.protobuf.Timestamp generate_time = 4 [(google.api.field_behavior) = OUTPUT_ONLY];
- // Output only. The time at which this [ImportJob][google.cloud.kms.v1.ImportJob] is scheduled for
- // expiration and can no longer be used to import key material.
- google.protobuf.Timestamp expire_time = 5 [(google.api.field_behavior) = OUTPUT_ONLY];
- // Output only. The time this [ImportJob][google.cloud.kms.v1.ImportJob] expired. Only present if
- // [state][google.cloud.kms.v1.ImportJob.state] is [EXPIRED][google.cloud.kms.v1.ImportJob.ImportJobState.EXPIRED].
- google.protobuf.Timestamp expire_event_time = 10 [(google.api.field_behavior) = OUTPUT_ONLY];
- // Output only. The current state of the [ImportJob][google.cloud.kms.v1.ImportJob], indicating if it can
- // be used.
- ImportJobState state = 6 [(google.api.field_behavior) = OUTPUT_ONLY];
- // Output only. The public key with which to wrap key material prior to
- // import. Only returned if [state][google.cloud.kms.v1.ImportJob.state] is
- // [ACTIVE][google.cloud.kms.v1.ImportJob.ImportJobState.ACTIVE].
- WrappingPublicKey public_key = 7 [(google.api.field_behavior) = OUTPUT_ONLY];
- // Output only. Statement that was generated and signed by the key creator
- // (for example, an HSM) at key creation time. Use this statement to verify
- // attributes of the key as stored on the HSM, independently of Google.
- // Only present if the chosen [ImportMethod][google.cloud.kms.v1.ImportJob.ImportMethod] is one with a protection
- // level of [HSM][google.cloud.kms.v1.ProtectionLevel.HSM].
- KeyOperationAttestation attestation = 8 [(google.api.field_behavior) = OUTPUT_ONLY];
- }
- // [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] specifies how cryptographic operations are performed.
- // For more information, see [Protection levels]
- // (https://cloud.google.com/kms/docs/algorithms#protection_levels).
- enum ProtectionLevel {
- // Not specified.
- PROTECTION_LEVEL_UNSPECIFIED = 0;
- // Crypto operations are performed in software.
- SOFTWARE = 1;
- // Crypto operations are performed in a Hardware Security Module.
- HSM = 2;
- // Crypto operations are performed by an external key manager.
- EXTERNAL = 3;
- }
- // ExternalProtectionLevelOptions stores a group of additional fields for
- // configuring a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] that are specific to the
- // [EXTERNAL][google.cloud.kms.v1.ProtectionLevel.EXTERNAL] protection level.
- message ExternalProtectionLevelOptions {
- // The URI for an external resource that this [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] represents.
- string external_key_uri = 1;
- }
|